Data breaches by UK Secret Service MI5

By Thomas Vink, 3rd June 2021

The UK Investigatory Powers Act gives the government the power to gather information about what people say and do online, even when they are not suspected of a crime. In 2019, it was revealed during a case taken by Liberty that the UK Security Service, MI5, for years may have been unlawfully copying and sharing innocent people’s data and storing it insecurely and for longer than allowed. Some members of MI5 had known about the risk of legal breach for years but kept it hidden.

Liberty and Privacy International brought a joint case to the UK Investigatory Powers Tribunal arguing that MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data. This case is an important piece of litigation for Liberty’s overall strategy of stopping mass surveillance, as it demonstrates that the legal safeguards that exist in legislation around mass surveillance are illusory in practice.

Data breaches by UK Secret Service MI5

Organisation Name

Liberty

Country/Jurisdiction

United Kingdom

Amount Granted

EUR 33,968

Current Status

Case won

Grant type

Single Instance Litigation Support

Description

The UK Investigatory Powers Act gives the government the power to gather information about what people say and do online, even when they are not suspected of a crime. In 2019, it was revealed during a case taken by Liberty that the UK Security Service, MI5, for years may have been unlawfully copying and sharing innocent people’s data and storing it insecurely and for longer than allowed. Some members of MI5 had known about the risk of legal breach for years but kept it hidden.

Liberty and Privacy International brought a joint case to the UK Investigatory Powers Tribunal arguing that MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data. The hearing at the tribunal took place from 25-29 July 2022.

This case is an important piece of litigation for Liberty’s overall strategy of stopping mass surveillance, as it demonstrates that the legal safeguards that exist in legislation around mass surveillance are illusory in practice.

On 30 January 2023, the tribunal made their decision, agreeing with Liberty and Privacy International’s arguments that MI5, in breach of key legal safeguards, unlawfully handled individuals’ private data that was gathered by secret surveillance. Additionally, they found that successive Home Secretaries did not enquire into or resolve this long-standing rule-breaking despite obvious red flags.

"MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data"

Strategic Goal

The Investigatory Powers Act is changed so that only those suspected of wrongdoing can have their data collected and stored, and that this data is stored securely.

Organisation Name

Women’s Link Worldwide

Image credit: Bernard Hermant on Unsplash